What is the CVSS score of CVE-2026-34733?

CVE-2026-34733 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2026-34733?

Yes, a patch is available for CVE-2026-34733. Update the affected software to the latest version immediately.

PHP CVE-2026-34733

EUVD-2026-17652 MEDIUM

Improper Access Control (CWE-284)

2026-03-31 GitHub_M

GHSA-wwpw-hrx8-79r5

PHP Authentication Bypass

6.5

CVSS 3.1 · GitHub Advisory

Severity by source

GitHub Advisory PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Primary rating from GitHub Advisory · only source for this CVE.

CVSS VectorGitHub Advisory

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

Low

Integrity

None

Availability

Low

Lifecycle Timeline

Patch released

Apr 02, 2026 - 02:30 nvd

Patch available

EUVD ID Assigned

Mar 31, 2026 - 21:14 euvd

EUVD-2026-17652

Analysis Generated

Mar 31, 2026 - 21:14 vuln.today

CVE Published

Mar 31, 2026 - 20:52 nvd

MEDIUM 6.5

DescriptionGitHub Advisory

WWBN AVideo is an open source video platform. In versions 26.0 and prior, the AVideo installation script install/deleteSystemdPrivate.php contains a PHP operator precedence bug in its CLI-only access guard. The script is intended to run exclusively from the command line, but the guard condition !php_sapi_name() = 'cli' never evaluates to true due to how PHP resolves operator precedence. The ! (logical NOT) operator binds more tightly than = (strict comparison), causing the expression to always evaluate to false, which means the die() statement never executes. As a result, the script is accessible via HTTP without authentication and will delete files from the server's temp directory while also disclosing the temp directory contents in its response. At time of publication, there are no publicly available patches.

AnalysisAI

Unauthenticated remote attackers can bypass CLI-only access controls in WWBN AVideo versions 26.0 and prior via a PHP operator precedence bug in install/deleteSystemdPrivate.php, allowing HTTP access to delete server temp directory files and disclose their contents without authentication. The vulnerability stems from a logic error where !php_sapi_name() === 'cli' evaluates incorrectly due to operator binding precedence, causing the access guard to fail entirely. No public exploit code or active exploitation has been reported at the time of this analysis.

Technical ContextAI

The vulnerability exists in the install/deleteSystemdPrivate.php script, which relies on a PHP access guard to restrict execution to CLI contexts only. The guard uses the expression !php_sapi_name() = 'cli', intending to deny access if the script is not running via CLI. However, PHP's operator precedence causes the logical NOT operator (!) to bind more tightly than the strict comparison operator (=), resulting in evaluation as (!php_sapi_name()) = 'cli' instead of the intended !(php_sapi_name() = 'cli'). When accessed via HTTP, php_sapi_name() returns a non-empty string (e.g., 'fpm-fcgi'), and the negation of a non-empty string becomes an empty string, which never equals the string 'cli', causing the guard condition to always evaluate false. This is a CWE-284 (Improper Access Control) vulnerability, specifically an authentication bypass through logic error. The affected product is WWBN AVideo (cpe:2.3:a:wwbn:avideo:*:*:*:*:*:*:*:*), with all versions up to and including 26.0 vulnerable.

RemediationAI

No vendor-released patch identified at time of analysis. Immediate mitigation steps should include: (1) restricting HTTP access to the install/ directory at the web server level (nginx, Apache) by denying all requests to paths matching install/*.php; (2) if the installation script is no longer needed post-deployment, deleting or moving the entire install/ directory off the web root; (3) implementing a Web Application Firewall (WAF) rule to block HTTP requests to install/deleteSystemdPrivate.php specifically. Administrators should monitor the GitHub Security Advisory (https://github.com/WWBN/AVideo/security/advisories/GHSA-wwpw-hrx8-79r5) for patch availability and upgrade immediately once a patched version is released. Organizations unable to apply patches should apply the web server-level access controls as a temporary measure and validate that no installation scripts remain web-accessible.